janniclas.loosenandClaude Opus 5.5
b24eb6c3e9
Every file under src/ exits outside WordPress (defined('ABSPATH') ||
exit; after the use block, so a direct request no longer prints a fatal
error with the server path); divi-convert-fixture.php gets the WP_CLI
guard the other integration scripts have. A unit test keeps both true;
PSR1 side-effects warning excluded for the guard.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
86 lines
2.0 KiB
PHP
86 lines
2.0 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace LIT\MCP;
|
|
|
|
use WP_User;
|
|
|
|
defined('ABSPATH') || exit;
|
|
|
|
/**
|
|
* Role gate: only users whose role is allowed get the lit_mcp_use capability.
|
|
*
|
|
* The capability is granted dynamically via user_has_cap, so no role objects
|
|
* in the database are modified.
|
|
*/
|
|
final class Access
|
|
{
|
|
public const CAPABILITY = 'lit_mcp_use';
|
|
public const OPTION = 'lit_mcp_allowed_roles';
|
|
private const DEFAULT_ROLES = ['administrator'];
|
|
private const ADAPTER_META_TOOLS = [
|
|
'discover_abilities',
|
|
'get_ability_info',
|
|
'execute_ability',
|
|
];
|
|
|
|
public function register(): void
|
|
{
|
|
add_filter('user_has_cap', [$this, 'grantCapability'], 10, 4);
|
|
|
|
foreach (self::ADAPTER_META_TOOLS as $tool) {
|
|
add_filter(
|
|
"mcp_adapter_{$tool}_capability",
|
|
static fn (): string => self::CAPABILITY
|
|
);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* @return list<string>
|
|
*/
|
|
public function allowedRoles(): array
|
|
{
|
|
$roles = get_option(self::OPTION, self::DEFAULT_ROLES);
|
|
if (! is_array($roles)) {
|
|
$roles = self::DEFAULT_ROLES;
|
|
}
|
|
|
|
$roles = apply_filters('lit_mcp_allowed_roles', $roles);
|
|
if (! is_array($roles)) {
|
|
$roles = self::DEFAULT_ROLES;
|
|
}
|
|
|
|
return array_values(array_filter($roles, 'is_string'));
|
|
}
|
|
|
|
/**
|
|
* @param array<string, bool> $allcaps
|
|
* @param list<string> $caps
|
|
* @param array<int, mixed> $args
|
|
* @return array<string, bool>
|
|
*/
|
|
public function grantCapability(
|
|
array $allcaps,
|
|
array $caps,
|
|
array $args,
|
|
WP_User $user
|
|
): array {
|
|
if (! in_array(self::CAPABILITY, $caps, true)) {
|
|
return $allcaps;
|
|
}
|
|
|
|
if (array_intersect($user->roles, $this->allowedRoles()) !== []) {
|
|
$allcaps[self::CAPABILITY] = true;
|
|
}
|
|
|
|
return $allcaps;
|
|
}
|
|
|
|
public static function currentUserMayUse(): bool
|
|
{
|
|
return current_user_can(self::CAPABILITY);
|
|
}
|
|
}
|